Additional Corporate Network Security for VPN/Remote Access Users

My company made it a policy to install a personal firewall appliance for all who access the network from remote or who are mobile users. The recommendation was to install Symantec Desktop Firewall (SDF). It, to me, was more than a recommendation since they were sending out installation discs....

When running the installation, I was prompted to install the Windows 2k Service Pack 1 before SDF could install. That took about 20 minutes and a reboot.....

OK, back to installing SDF. It lasted all of 8 minutes; I liked that! You only need a Pentium-class processor and 35 MB of hard drive space. I'll assume that most PC's have a CD-ROM and Internet access (otherwise you wouldn't be reading this review ::wink wink::).

I went immediately to open the application via the system tray icon to update the software. A new Live Update GUI reared it's unfamiliar head to list 6 packages/items which were going to be checked for upgrades. Not all of them looked as if they were related to SDF, so I was naturally somewhat wary. I realized after watching the messages when the patches were being installed that Live Update now consolidated the updating of Norton Antivirus (my viral protection) and SDF into one interface.

After updating the software I was immediately prompted 6 times in a row for outbound traffic that was triggering alerts by SDF. Internet Explorer, Windows Media Player, webHancer Customer Companion, Nortel Extranet Access Client (VPN) and Outlook were all open at the time and they now all have firewall rules (some auto-configured) which allow certain traffic (all or custom).

I didn't notice, and haven't yet, any local performance degradation from installing the software or my web browsing speed.

Back-door access attempts from outside will be evidenced by a red exclamation mark over the SDF system tray icon. You have to open the utility to be able to clear the security alert. An extra button will display on the main page ONLY when a security alert has been triggered.

While we're in the main page, let's talk about the layout.

The top toolbar has 2 buttons: LiveUpdate and Options.

LiveUpdate I've already explained.

Options - an intermediate page to access:

1.) Event Log - similar to an event log of NT and Win 2k, you can view events for Content Blocking, Connections, the Firewall, Privacy, System and a Web History. To clear the event log, you can click "Log/Clear Tab" or "Log/Clear All Tabs" or "Log/Clear All Tabs Upon Logoff."

2.) Statistics - a live accounting of Network (traffic to and from your computer), Web (graphics, cookies, refer reqs blocked, etc.), Firewall TCP connections, Firewall UDP datagrams, Firewall Rules activity and Network Connections. It refreshes all stats every 60 seconds. A window pane is at the bottom using a line graph refreshing with a bar that slides from left to right as the 60 seconds passes.

3.) Clear statistics - a button to do just what it says.

4.) Advanced Options - customize your Firewall settings for the internet (i.e. cookies, browsing refers, email from etc.), add/view/modify/remove/test/enable/disable any existing firewall rule [You can also shuffle their order using the arrows toward the bottom of the window], the last tab "Other" allows customization of your http ports, IGMP protocols, fragmented IP packages and enable/disable automatic firewall rule creation.

By the time I began to poke around in the GUI, I realized the simplicity of the main page was veeeery misleading as to the level of customization possible with SDF.

[Back to the main page]

3 main buttons on the left give you most frequently used features: Status, Security and Privacy

Status allows you to enable/disable the Security and/or Privacy services.

Security defaults to a slide rule set in the middle which determines the level of internet security. A "Custom Level" button is near the bottom which launches a second window where you can further define SDF's handling of all internet communications, Java Applet Security and ActiveX Control Security. Each only has 3 settings: None, Medium and High.

Privacy also defaults to a slide rule set in the middle which determines the level of internet privacy. A "Custom Level" button is near the bottom which launches a second window where you can further define SDF's handling of forking over confidential information and cookie blocking. These two features also only have 3 settings: None, Medium and High. You also have 2 check boxes for Enabling Browser privacy and Enabling Secure Connections via https).

The SDF Helpfile is decent in that it has good, easy-to-understand explanations for technical terms that relate to the SDF functionality.

The link to their Tech Support Web site takes you to a page where you decide of you are a "Home/Small Business User" or an "Enterprise User." SDF is classified as an enterprise product from it's website, so I chose appropriately and was presented with links to a Knowledgebase, Updates/Patches, Manuals and Documentation (in Acrobat) which I downloaded to by the way, and interactive tutorials (in Shockwave).

The interactive tutorials are actually pretty cool. Voice and animation combine together interactively to make sure you don't have to learn by trial-and-error when configuring and using SDF. They get brownie points from me on this one.

To summarize, SDF monitors inbound and outbound communications. Marketed as targeting "always-connected" broadband ISP connections like DSL and Cable Modems, Symantec has, yet another, well-put together enterprise-class product.

Other features that SDF offers:

*Application fingerprinting - basically characterizes software and when it behaves/communicates out of character, it Alerts as suspicious behavior

*Full path support - requires that applications launch from the same directory location

*Firewall rules are encrypted from outside tampering

*SDF can be deployed via SMS, login scripts or web installations

Overall, I think it's a solid package and has a well-thought out GUI to navigate.

Happy computing!